Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:18:11.470Z",
  "pubdate": "2026-08-18T21:18:11.470Z",
  "executiveSummary": "A security vulnerability has been identified within the Imperative Web Server component of Oracle Fusion Middleware's Helidon product, specifically affecting version 4.5.0. This easily exploitable vulnerability enables a low-privileged threat actor with network access via HTTPS to compromise the affected Helidon deployment.\nSuccessful exploitation of this flaw can lead to severe security implications, granting unauthorized actors the capability to execute creation, deletion, and modification operations against critical or fully accessible Helidon data. Additionally, it permits unauthorized read access to sensitive critical data or complete data sets managed by the application.\nThe vulnerability carries a CVSS 3.1 Base Score of 8.1, reflecting high impacts on both confidentiality and integrity while maintaining no availability impact. The corresponding CVSS vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).\nThe risk implications are substantial for organizations utilizing the impacted version, as the requirement for low privileges combined with remote network accessibility over HTTPS significantly broadens the potential attack surface. Threat actors possessing standard user credentials can leverage this flaw to compromise data confidentiality and integrity without requiring user interaction.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. The flaw stems from insufficient authorization and access control enforcement within the web server handling of HTTPS requests, allowing authenticated users with low privileges to bypass intended security boundaries.\nExploitation of this vulnerability requires network access via the HTTPS protocol. The attack vector is classified as network (AV:N), meaning the attacker does not require physical or local access to the underlying host system. The attack complexity is low (AC:L), indicating that successful exploitation does not depend on complex preconditions, race conditions, or highly specialized configurations.\nThe attacker must possess low privileges (PR:L), necessitating valid authentication credentials within the Helidon environment. However, no user interaction (UI:N) is required, allowing for automated or script-driven exploitation once access is established. The scope remains unchanged (S:U), as the vulnerability's impact is confined to the resources managed by the vulnerable Helidon component.\nDuring the attack flow, a low-privileged adversary transmits maliciously crafted HTTPS requests targeting the vulnerable Imperative Web Server component. Due to inadequate validation of authorization parameters and access control lists, the server processes these requests and grants unauthorized operations against critical data stores.\nPost-exploitation impact includes the complete compromise of data confidentiality and integrity. Attackers can exfiltrate sensitive critical data, as well as impermissibly create, modify, or delete application data, leading to severe data corruption, privacy violations, and loss of systemic trust within the Helidon environment."
}